ZDI Advisories
669 advisoriesZero Day Initiative vulnerability advisories – published disclosures and upcoming publications.
Samsung Galaxy S25 Samsung Members Open Redirect Security Bypass Vulnerability
A medium-severity security bypass vulnerability exists in Samsung Galaxy S25 devices that allows remote attackers to circumvent security controls…
Delta Electronics ASDA-Soft PAR File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
Delta Electronics ASDA-Soft contains a remote code execution vulnerability (CVE-2026-1361) rated 7.8 HIGH, which attackers can exploit by tricking…
VMware ESXi VMCI Integer Underflow Local Privilege Escalation Vulnerability
VMware ESXi is vulnerable to a local privilege escalation attack (CVE-2025-41237) rated as HIGH severity with a CVSS score of 8.2, requiring…
QNAP TS-453E Hyper Data Protector Plugin Hard-Coded Credentials Authentication Bypass Vulnerability
A medium-severity authentication bypass vulnerability (CVE-2025-59388) affects QNAP TS-453E NAS devices, allowing network-adjacent attackers to gain…
Linux Kernel nf_tables_newset Out-Of-Bounds Write Information Disclosure Vulnerability
This vulnerability in the Linux Kernel allows local attackers to read sensitive information on affected systems, but requires them to already have…
Linux Kernel nf_tables Use-After-Free Privilege Escalation Vulnerability
CVE-2022-32250 is a privilege escalation vulnerability in the Linux Kernel that allows local attackers with low-privileged code execution to escalate…
ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability
ChargePoint Home Flex charging stations contain a high-severity vulnerability (CVE-2026-4155, CVSS 7.5) that allows unauthenticated remote attackers…
QNAP TS-453E nvrlog_event_add msg SQL Injection Remote Code Execution Vulnerability
A high-severity remote code execution vulnerability (CVE-2025-62849) affects QNAP TS-453E network-attached storage devices, allowing network-adjacent…
ChargePoint Home Flex OCPP getpreq Stack-based Buffer Overflow Remote Code Execution Vulnerability
ChargePoint Home Flex EV chargers contain a critical vulnerability (CVE-2026-4156) that allows network-adjacent attackers to execute arbitrary code…
Canon imageCLASS MF654Cdw XPS Parser Stack-based Buffer Overflow Remote Code Execution Vulnerability
CVE-2025-14232 is a critical remote code execution vulnerability affecting Canon imageCLASS MF654Cdw printers that allows unauthenticated,…
ChargePoint Home Flex revssh Service Command Injection Remote Code Execution Vulnerability
ChargePoint Home Flex devices contain a critical vulnerability (CVE-2026-4157) that allows unauthenticated, network-adjacent attackers to execute…
QNAP TS-453E malware_remover Code Injection Remote Code Execution Vulnerability
A critical unauthenticated remote code execution vulnerability (CVE-2025-11837) has been identified in QNAP TS-453E NAS devices, allowing…
Canon imageCLASS MF654Cdw dtdc_addr_importSub Stack-based Buffer Overflow Remote Code Execution Vulnerability
Canon imageCLASS MF654Cdw printers contain a network-based vulnerability (CVE-2025-14236) that allows unauthenticated attackers to execute arbitrary…
Canon imageCLASS MF654Cdw TTF Parsing Integer Overflow Remote Code Execution Vulnerability
A critical vulnerability (CVE-2025-14237) in Canon imageCLASS MF654Cdw printers allows unauthenticated attackers on the network to execute arbitrary…
GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
GIMP contains a remote code execution vulnerability (CVE-2026-2049) with a CVSS score of 7.8 that allows attackers to execute arbitrary code if a…
Schneider Electric EcoStruxure Data Center Expert Hard-coded Password Remote Code Execution Vulnerability
Schneider Electric EcoStruxure Data Center Expert contains a critical vulnerability (CVE-2025-13957) that allows authenticated remote attackers to…
GIMP LBM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
GIMP contains a remote code execution vulnerability (CVE-2026-2046) that allows attackers to execute arbitrary code if a user opens a malicious file…
Microsoft Windows cdd Improper Locking Local Privilege Escalation Vulnerability
A privilege escalation vulnerability (CVE-2026-23668) in Microsoft Windows allows attackers who already have low-level code execution to gain…
Microsoft Windows win32full Improper Release Local Privilege Escalation Vulnerability
Microsoft Windows contains a privilege escalation vulnerability (CVE-2026-24285) that allows local attackers with low-privileged code execution to…
Microsoft Windows win32full Improper Release Local Privilege Escalation Vulnerability
This vulnerability is a privilege escalation flaw in Microsoft Windows (CVE-2026-24285) that allows attackers with low-level code execution to gain…
Microsoft Windows win32kfull Improper Locking Local Privilege Escalation Vulnerability
CVE-2026-23668 is a high-severity privilege escalation vulnerability in Microsoft Windows that allows local attackers to gain elevated system…
Apple macOS libusd_ms Alembic File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
A high-severity remote code execution vulnerability (CVE-2026-20616) has been discovered in Apple macOS that allows attackers to execute arbitrary…
Microsoft Windows cdd Improper Locking Local Privilege Escalation Vulnerability
A local privilege escalation vulnerability in Microsoft Windows (CVE-2026-23668) allows attackers with low-level code execution to gain elevated…
Fortinet FortiClient Link Following Local Privilege Escalation Vulnerability
A high-severity privilege escalation vulnerability exists in Fortinet FortiClient that allows local attackers with low-privileged code execution to…
Microsoft Windows win32full Improper Release Local Privilege Escalation Vulnerability
A privilege escalation vulnerability (CVE-2026-24285) has been identified in Microsoft Windows with a CVSS score of 7.8.
Array Networks MotionPro ArrayInstallManager Incorrect Permission Assignment Local Privilege Escalation Vulnerability
A privilege escalation vulnerability (CVE-2026-26364) in Array Networks MotionPro allows attackers with low-level code execution to gain elevated…
Apple macOS Audio APAC Frame Decoding Out-Of-Bounds Write Remote Code Execution Vulnerability
Apple macOS contains a remote code execution vulnerability (CVE-2026-20611) with a CVSS score of 7.8 that can be exploited when users interact with…
Microsoft Windows GDI Bitmap Parsing Out-Of-Bound Read Information Disclosure Vulnerability
This vulnerability in Microsoft Windows GDI library allows remote attackers to access sensitive information without requiring user authentication.
Apple macOS ImageIO SGI File Parsing Integer Overflow Remote Code Execution Vulnerability
CVE-2026-20675 is a high-severity remote code execution vulnerability in Apple's macOS ImageIO library that allows attackers to execute arbitrary…
Apple macOS ImageIO SGI File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
A low-severity information disclosure vulnerability exists in Apple's macOS ImageIO framework (CVE-2026-20634) that allows remote attackers to access…